THC-Hydra
Last updated
Last updated
THC-Hydra is a tool that was developed for security researchers to help testing the robustness of password-based systems. Hydra is a tool to guess/crack valid login/password pairs.
This tool has multiple options. You should look at the help of the function to learn about its functionalities.
Which produces the following result. This is simply a part of the output that this command presents.
Hydra supports a large set of protocols and services, such as:
POP3
FTP
HTTP-GET, HTTP-POST-FORM, HTTP-GET-FORM
Firebird
Subversion
Telnet
Postgres
SSH
Teamspeak
MySQL
rexec
SOCKS5
SNMP
NNTP
... more.
THC-Hydra can handle the following types os attacks:
Brute force attacks
Dictionary attacks
Parallel attacks (16 threads by default, -t option)
Check for null, login as password, reversed characters (-e option)
Attack several different servers
There are also some graphical tools for THC-Hydra, such as xhydra. You may install and launch this tool by doing:
In the example, we are going to launch a dictionary attack against the FCP service of the victim. In order to do this we need to use a word list file (the dictionary) that contain the words to be used as passwords.
We may create that file, or we may use some file downloaded from the Internet (please refer to the first part of this document) or we may also use some of the word list files that are part of Kali Linux. You may find such files on the /usr/share/wordlists folder.
It is important to notice that, the bigger the file, the longer will be the processing time of such file.
For demonstration purposes, let's create two files. The first one will be called users.txt and will contain a list of possible users:
And we will also create a file called passwords.txt which will contain the list of most common passwords in 2022:
If you don't want to create these files, I've created them for you. You can download here the list of users and the list of passwords.
Now, we can start the THC-Hydra to test the FCP service and check if some of the users and passwords match some existing user on the FTP service.
-L is used to specify the file that contain the usernames, in this case users.txt
-P is used to specify the file that contain the passwords, in this case passwords.txt
-v activates the verbose mode
-V displays each attempt with a username/password pair
You'll get a similar output to this one:
After running the tool, try to interpret its results and check if you were able to find some valid username/password pair.
You may also run THC-Hydra to just try to do a dictionary attack against a specific username. In this case you have to specify the username and simply use the passwords.txt file. The command is similar:
Which results in:
In this case, we are going to launch a dictionary attack against the SSH service on the victim. The approach is similar to the one presented before, the only difference is just to chance the service name:
Note: this will only work if the SSH service accepts password-based authentication.
In here we are going to use dictionary attacks against web applications.
In order to do this, we will use a vulnerable web application called DVWA. You'll find more information about how to install DVWA in this section.
For this sake, we'll assume that you already have DVWA installed and that it can be used.
First, lets navigate login page of the application and we will try to use a dictionary attack to crack the authentication web page of the application.
In order to find how to conduct the attack, we need to inspect the web page to understand how we could use THC-Hydra to launch the attack.
After looking at the page we learn that is necessary to send the following parameters, through the POST method:
username: this is the name of the user
password: this is the password of the user
Login: a variable that always contains the value "Login"
We also need to understand what fails in the case of a bad authentication. In this case we notice that the application presents the message "Login Failed". This is important for THC-Hydra to distinguish a successful from unsuccessful login attempts.
So in order to conduct this attack, we need to do:
Some of the parameters are already known, but lets look at some others:
-I: ignore an existing restore file - basically it always starts over.
-e ns: try "n" null password, "s" login as pass and/or "r" reversed login. In this case, we are going to test for null passwords and also use the username as password as well.
-F: exit when a login/pass pair is found. This will immediately stop the search for more passwords, when one is found. This is not a good idea if you are planning on trying to identify/find all the possible passwords.
-u: loop around users, not passwords
-t 1: run TASKS number of connects in parallel per target. In this case we are just using a single task.
-w 10: wait time for a response. This indicates that THC-Hydra will wait for 10 seconds before giving a timeout.
After this we should look at the output of the THC-Hydra tool:
You may find more details by using the following command to get more usage options for a given module:
Now we are going to try with a different web application. Metasploitable 2 also packs another vulnerable web application called Mutillidae.
This Mutillidae is also a vulnerable web application that was developed in PHP that might also be used for demonstration of multiple web application security problems. However, in this case, we might use it also for demonstrating attacks against passwords.
After having Mutillidae up and running, we may try to attack it using also THC-Hydra. Again, and similarly to what happened before, we need to study our target before launching the proper attack. So lets look at the URL we want to target and that contains the authentication form:
So, this page has a form that expects a set of parameters to be send through the POST method. These values are:
username: this is the name of the user
password: this is the password of the user
Login: a variable called login-php-submit-button that always contains the value "Login"
We also need to understand what fails in the case of a bad authentication. In this case we notice that the application presents the message "Password Incorrect". This is important for THC-Hydra to distinguish a successful from unsuccessful login attempts.
So in order to conduct this attack, we need to do:
The parameters are the same that were used before. The results are:
Hydra v9.4 (c) 2022 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).
Next we will try to use THC-Hydra to attack a well-known CMS system, that is used too host multiple web sites - Wordpress. For this, we need to install or use an already existing Wordpress instance.
One possible option is to install Wordpress using Docker. There is a nice guide that explains how to install Wordpress on Docker. Another alternative is to install Wordpress in a virtual machine - either VirtualBox or VMware. A great place to obtain and download such virtual machines is on Bitnami - you may find the direct download of Wordpress VM here.
Depending on how install the Wordpress, you have access to this address for users to login (remember that the address might change):
As always, we need to analyze the website to learn which are the parameters that are required by the form to operate. After this analysis we find that the form requires the following parameters to be used - via POST:
log: this contains the username of the user
pwd: this contains the password of the user
wp-submit: the button to submit the request, that should receive the value Log In
testcookie: an hidden value that is required to be passed during the login process and that has the value 1
redirect_to: an hidden value that shows where the page will redirect upon a successful login, in this case has the value http://localhost:8000/wp-admin/
We need to understand also what happens when the authentication is successful. In this case it will happen a redirect on the page. So we can test in the case of success (S) and having the location changed (Location).
So lets run THC-Hydra:
In this case, we have a new option that is going to the be used:
-s 8000: This option is used to specify the port in which the web application is running. In this case the web application runs on port 8000
If everything goes well, we will obtain a result:
All the attacks we have been performing are dictionary attacks. This requires the existence of a good word list that allows someone to find the password, if a word in the list was used as a password. This might not be always the case. So we might need to use a brute-force attack to test every possible combination as a password.
In order to use this, we need to use the option -x that allows the generation of passwords according to a given mask. You may use the following command to obtain more options about this functionality:
That displays this help:
So if we want to brute-force a service with only passwords that are numbers, we can do the following (in this case we are going to use only numbers from 0-999999):
We can try passwords that are only lower case letters, with 5 characters in length:
Or we can use multiple combinations, such as using lower and upper case letters, and also numbers:
This results in 916132832 possible combinations. :-)
